From b5481df6f5c59e344a47fa591ca8e4887375942a Mon Sep 17 00:00:00 2001
From: Darcy Ye <darcyye@silverhand.io>
Date: Mon, 9 Dec 2024 11:14:33 +0800
Subject: [PATCH] refactor: refactor code

---
 .../core/src/saml-applications/libraries/consts.ts | 14 ++++++++++++++
 .../core/src/saml-applications/routes/anonymous.ts | 10 +++++-----
 .../core/src/saml-applications/routes/utils.ts     | 11 ++++++++++-
 3 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/packages/core/src/saml-applications/libraries/consts.ts b/packages/core/src/saml-applications/libraries/consts.ts
index cf8abae46..4eb72609d 100644
--- a/packages/core/src/saml-applications/libraries/consts.ts
+++ b/packages/core/src/saml-applications/libraries/consts.ts
@@ -20,3 +20,17 @@ export const samlLogInResponseTemplate = `
     {AttributeStatement}
   </saml:Assertion>
 </samlp:Response>`;
+
+export const samlAttributeNameFormatBasic = 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic';
+
+const samlValueXmlnsXsiString = 'xs:string';
+const samlValueXmlnsXsiInteger = 'xsd:integer';
+const samlValueXmlnsXsiBoolean = 'xsd:boolean';
+const samlValueXmlnsXsiDatetime = 'xsd:dateTime';
+
+export const samlValueXmlnsXsi = {
+  string: samlValueXmlnsXsiString,
+  integer: samlValueXmlnsXsiInteger,
+  boolean: samlValueXmlnsXsiBoolean,
+  datetime: samlValueXmlnsXsiDatetime,
+};
diff --git a/packages/core/src/saml-applications/routes/anonymous.ts b/packages/core/src/saml-applications/routes/anonymous.ts
index 743c79935..16c5c9e2c 100644
--- a/packages/core/src/saml-applications/routes/anonymous.ts
+++ b/packages/core/src/saml-applications/routes/anonymous.ts
@@ -9,7 +9,7 @@ import { fetchOidcConfig, getUserInfo } from '#src/sso/OidcConnector/utils.js';
 import { SsoConnectorError } from '#src/sso/types/error.js';
 import assertThat from '#src/utils/assert-that.js';
 
-import { samlLogInResponseTemplate } from '../libraries/consts.js';
+import { samlLogInResponseTemplate, samlAttributeNameFormatBasic,samlValueXmlnsXsi } from '../libraries/consts.js';
 
 import { exchangeAuthorizationCode, generateAutoSubmitForm, createSamlResponse } from './utils.js';
 
@@ -129,14 +129,14 @@ export default function samlApplicationAnonymousRoutes<T extends AnonymousRouter
             {
               name: 'email',
               valueTag: 'email',
-              nameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic',
-              valueXsiType: 'xs:string',
+              nameFormat: samlAttributeNameFormatBasic,
+              valueXsiType: samlValueXmlnsXsi['string'],
             },
             {
               name: 'name',
               valueTag: 'name',
-              nameFormat: 'urn:oasis:names:tc:SAML:2.0:attrname-format:basic',
-              valueXsiType: 'xs:string',
+              nameFormat: samlAttributeNameFormatBasic,
+              valueXsiType: samlValueXmlnsXsi['string'],
             },
           ],
         },
diff --git a/packages/core/src/saml-applications/routes/utils.ts b/packages/core/src/saml-applications/routes/utils.ts
index 59d9be3e0..bc540ff68 100644
--- a/packages/core/src/saml-applications/routes/utils.ts
+++ b/packages/core/src/saml-applications/routes/utils.ts
@@ -35,13 +35,22 @@ const createSamlTemplateCallback =
       Issuer: idp.entityMeta.getEntityID(),
       IssueInstant: now.toISOString(),
       AssertionConsumerServiceURL: assertionConsumerServiceUrl,
-      StatusCode: 'urn:oasis:names:tc:SAML:2.0:status:Success',
+      StatusCode: saml.Constants.StatusCode.Success,
       ConditionsNotBefore: now.toISOString(),
       ConditionsNotOnOrAfter: expireAt.toISOString(),
       SubjectConfirmationDataNotOnOrAfter: expireAt.toISOString(),
       NameIDFormat: selectedNameIDFormat,
       NameID: user.sub,
       InResponseTo: 'null',
+      /**
+       * User attributes for SAML response
+       *
+       * @todo Support custom attribute mapping
+       * @see {@link https://github.com/tngan/samlify/blob/master/src/libsaml.ts#L275-L300|samlify implementation}
+       *
+       * @remarks
+       * By examining the code provided in the link above, we can define all the attributes supported by the attribute mapping here. Only the attributes defined in the `loginResponseTemplate.attributes` added when creating the IdP instance will appear in the SAML response.
+       */
       attrEmail: user.email,
       attrName: user.name,
     };